Permissions-Policy

Permissions-Policy is an HTTP response header that lets a site control which powerful browser features — camera, microphone, geolocation, payment, and more — are available on the page and to any embedded iframes. It succeeded the earlier Feature-Policy header with a revised syntax and a more complete specification.

Why It Matters

Modern browsers expose a growing set of powerful APIs that require user permission: access to the camera, microphone, geolocation, accelerometer, clipboard, and so on. These APIs can be misused by third-party scripts embedded on a page — ad networks, analytics libraries, or compromised dependencies — to silently probe or collect data.

Permissions-Policy gives the page author explicit control. A page that has no need for camera access can disable it entirely, ensuring that even if a third-party script attempts to call the camera API, the browser will refuse before any permission prompt appears.

Syntax: Allowlists and Empty Disable

Each directive is a feature name followed by a parenthesised allowlist of origins. The allowlist uses structured-header syntax — quoted strings for specific origins, unquoted tokens for keywords.

Permissions-Policy: geolocation=(self "https://maps.example.com"), camera=(), microphone=(self)

The keyword * allows any origin. Omitting a feature from the header entirely leaves the browser's default behaviour for that feature unchanged — it does not disable it.

Successor to Feature-Policy

The earlier Feature-Policy header used a different syntax and was never fully standardised. Permissions-Policy replaces it with the structured-field value format defined in RFC 8941. The feature names are largely the same, but the allowlist syntax changed: Feature-Policy: geolocation 'self' becomes Permissions-Policy: geolocation=(self). Some browsers still accept the old header for compatibility, but new deployments should use Permissions-Policy.

iframe Delegation

A parent page cannot grant an iframe more permissions than the parent itself has. But a parent can restrict what iframes receive, even if the feature is allowed for the page. The iframe's allow attribute works alongside the header to delegate specific features:

<iframe src="https://maps.example.com/embed" allow="geolocation"></iframe>

Both the HTTP header on the parent page and the allow attribute on the iframe element must permit a feature for the iframe to access it. If either denies it, the feature is unavailable in the iframe regardless of the other.

Common Features to Lock Down

Audit your Permissions-Policy with the headers tool

Open Headers Tool

Audit your Permissions-Policy with the headers tool →